@sechroom/cli 2026.6.24 → 2026.6.26

package/dist/index.js

@@ -375,8 +375,8 @@ async function promptYesNo(question) {
   const { createInterface } = await import("readline");
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = await new Promise((resolve2) => {
-      rl.question(`${question} [y/N] `, resolve2);
+    const answer = await new Promise((resolve3) => {
+      rl.question(`${question} [y/N] `, resolve3);
     });
     return /^y(es)?$/i.test(answer.trim());
   } finally {
@@ -389,8 +389,8 @@ async function promptText(question, def) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
     const suffix = def ? ` [${def}]` : "";
-    const answer = await new Promise((resolve2) => {
-      rl.question(`${question}${suffix} `, resolve2);
+    const answer = await new Promise((resolve3) => {
+      rl.question(`${question}${suffix} `, resolve3);
     });
     const trimmed = answer.trim();
     return trimmed.length > 0 ? trimmed : def ?? "";
@@ -416,8 +416,8 @@ async function promptSelect(question, choices, def) {
       process.stderr.write(`  ${marker} ${style.bold(String(i + 1))}. ${c.label}${hint}
 `);
     });
-    const answer = await new Promise((resolve2) => {
-      rl.question(`Choose ${style.dim(`[${defIdx + 1}]`)} `, resolve2);
+    const answer = await new Promise((resolve3) => {
+      rl.question(`Choose ${style.dim(`[${defIdx + 1}]`)} `, resolve3);
     });
     const trimmed = answer.trim();
     if (!trimmed) return choices[defIdx].value;
@@ -449,8 +449,8 @@ async function promptMultiSelect(question, choices, preselected = []) {
       process.stderr.write(`  ${box} ${style.bold(String(i + 1))}. ${c.label}${hint}
 `);
     });
-    const answer = await new Promise((resolve2) => {
-      rl.question(`Select ${style.dim("[Enter = \u25C9]")} `, resolve2);
+    const answer = await new Promise((resolve3) => {
+      rl.question(`Select ${style.dim("[Enter = \u25C9]")} `, resolve3);
     });
     const trimmed = answer.trim().toLowerCase();
     if (!trimmed) return preValues();
@@ -2681,6 +2681,24 @@ function codeLanePrefix(clients) {
   for (const c of CLIENT_PRIORITY) if (clients.includes(c)) return CODE_LANE_PREFIX_BY_CLIENT[c];
   return "claude-code";
 }
+async function inferLanes(cfg, clients) {
+  let wf;
+  let profile;
+  try {
+    const client = await makeClient(cfg);
+    [wf, profile] = await Promise.all([
+      client.GET("/me/workflow-preferences", {}).then((r) => r.data).catch(() => void 0),
+      client.GET("/me/profile", {}).then((r) => r.data).catch(() => void 0)
+    ]);
+  } catch {
+  }
+  const handle = handleFromDisplayName(profile?.effectiveDisplayName);
+  const prefix = codeLanePrefix(clients ?? ["claude-code"]);
+  return {
+    code: process.env.SECHROOM_CODE_LANE ?? wf?.defaultCodeLane ?? (handle ? `${prefix}-${handle}` : void 0),
+    design: process.env.SECHROOM_DESIGN_LANE ?? wf?.defaultDesignLane ?? (handle ? `claude-design-${handle}` : void 0)
+  };
+}
 function writePin(code, design) {
   const values = {};
   if (code) values["code-lane"] = code;
@@ -2693,20 +2711,7 @@ function writePin(code, design) {
 async function ensureLanePin(cfg, opts) {
   if (opts.dryRun) return;
   if (readSem()) return;
-  let wf;
-  let profile;
-  try {
-    const client = await makeClient(cfg);
-    [wf, profile] = await Promise.all([
-      client.GET("/me/workflow-preferences", {}).then((r) => r.data).catch(() => void 0),
-      client.GET("/me/profile", {}).then((r) => r.data).catch(() => void 0)
-    ]);
-  } catch {
-  }
-  const handle = handleFromDisplayName(profile?.effectiveDisplayName);
-  const prefix = codeLanePrefix(opts.clients ?? ["claude-code"]);
-  const codeGuess = wf?.defaultCodeLane ?? (handle ? `${prefix}-${handle}` : void 0);
-  const designGuess = wf?.defaultDesignLane ?? (handle ? `claude-design-${handle}` : void 0);
+  const { code: codeGuess, design: designGuess } = await inferLanes(cfg, opts.clients);
   if (!canPrompt() || opts.yes) {
     if (opts.yes && (codeGuess || designGuess)) writePin(codeGuess, designGuess);
     return;
@@ -2938,6 +2943,113 @@ async function runClients(clients, cmd, opts) {
   process.stdout.write(opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : "\nDone.\n");
 }
 
+// src/commands/onboard.ts
+import { existsSync as existsSync7 } from "fs";
+import { join as join7 } from "path";
+
+// src/commands/fanout.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync, statSync } from "fs";
+import { isAbsolute, join as join6, resolve } from "path";
+var ICON = {
+  refresh: "\u21BB",
+  bind: "+",
+  "skip-missing": "\u2013",
+  "skip-unbound": "\u26A0"
+};
+function resolveChildDir(path, root) {
+  return isAbsolute(path) ? path : resolve(root, path);
+}
+function discoverChildren(root) {
+  let names;
+  try {
+    names = readdirSync(root);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of names.sort()) {
+    if (name.startsWith(".") || name === "node_modules") continue;
+    const dir = join6(root, name);
+    try {
+      if (!statSync(dir).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    if (existsSync6(join6(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+  }
+  return out;
+}
+function readManifest(path) {
+  if (!existsSync6(path)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync5(path, "utf8"));
+  } catch (err2) {
+    throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+  }
+  return Array.isArray(parsed.repos) ? parsed.repos.filter((r) => r && typeof r.path === "string") : [];
+}
+function passthroughGlobals(g) {
+  const out = [];
+  if (g.baseUrl) out.push("--base-url", g.baseUrl);
+  if (g.tenant) out.push("--tenant", g.tenant);
+  return out;
+}
+function runChildren(plans, o) {
+  const { globals, dryRun, json } = o;
+  const results = [];
+  for (const plan of plans) {
+    const runs = plan.argv.length > 0;
+    const argv = runs ? [...globals, ...plan.argv] : [];
+    if (!json) {
+      process.stderr.write(`  ${ICON[plan.disposition]} ${style.cyan(plan.label)} ${style.dim(plan.reason)}
+`);
+      if (runs && dryRun) process.stderr.write(`      ${style.dim(`would run: sechroom ${argv.join(" ")}`)}
+`);
+    }
+    let exitCode = runs ? 0 : null;
+    if (runs && !dryRun) {
+      const res = spawnSync(process.execPath, [process.argv[1], ...argv], {
+        cwd: plan.dir,
+        stdio: json ? "ignore" : "inherit"
+      });
+      exitCode = res.status;
+      if (!json) {
+        process.stderr.write(
+          exitCode === 0 ? `      ${ok("\u2713")} ${style.dim("onboard ok")}
+` : `      ${warn("\u2717")} ${style.dim(`onboard exited ${exitCode ?? "signal"}`)}
+`
+        );
+      }
+    }
+    results.push({
+      path: plan.label,
+      dir: plan.dir,
+      disposition: plan.disposition,
+      ran: runs && !dryRun,
+      exitCode,
+      reason: plan.reason
+    });
+  }
+  return results;
+}
+function summarizeFanout(results, o) {
+  const ran = results.filter((r) => r.ran);
+  const failed = ran.filter((r) => r.exitCode !== 0);
+  const skipped = results.filter((r) => r.disposition.startsWith("skip"));
+  const wouldRun = results.filter((r) => !r.disposition.startsWith("skip"));
+  const tally = (o.dryRun ? [wouldRun.length ? `${wouldRun.length} would onboard` : null, skipped.length ? `${skipped.length} would skip` : null] : [
+    ran.length ? `${ran.length - failed.length}/${ran.length} onboarded` : null,
+    skipped.length ? `${skipped.length} skipped` : null,
+    failed.length ? `${failed.length} failed` : null
+  ]).filter(Boolean).join(", ");
+  process.stderr.write(`
+${failed.length ? warn("\u26A0") : ok("\u2713")} ${tally || "nothing to do"}${o.dryRun ? style.dim(" (dry run)") : ""}
+`);
+  if (failed.length) process.exit(1);
+}
+
 // src/commands/onboard.ts
 var DEFAULT_BASE_URL2 = "https://app.sechroom.ai/api";
 function systemTimezone() {
@@ -3010,7 +3122,7 @@ async function warnIfProjectStray(client, projectId, workspaceId, json) {
     );
   }
 }
-async function pickWorkspace(client) {
+async function pickWorkspace(client, promptLabel = "Bind this directory to a workspace:") {
   const all = await withSpinner("Listing your workspaces", () => fetchWorkspaces(client));
   if (all.length === 0) {
     process.stderr.write(`no workspaces found \u2014 skipping workspace binding (you can set it later with \`sechroom config set --local workspaceId <id>\`)
@@ -3033,7 +3145,7 @@ async function pickWorkspace(client) {
     ...pool.slice().sort((a, b) => workspacePath(a, byId).localeCompare(workspacePath(b, byId))).map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: w.id })),
     { label: style.dim("skip \u2014 don't bind a workspace"), value: SKIP, hint: void 0 }
   ];
-  const chosen = await promptSelect("Bind this directory to a workspace:", choices, SKIP);
+  const chosen = await promptSelect(promptLabel, choices, SKIP);
   if (chosen === SKIP) return void 0;
   const picked = byId.get(chosen);
   const collisions = all.filter((w) => w.id !== picked.id && namesCollide(w.name, picked.name));
@@ -3191,8 +3303,109 @@ async function chooseClients(clientFlag, yes, cwd) {
   );
   return picks.length > 0 ? picks : preselected;
 }
+async function planRecurseChild(entry, root, client, opts) {
+  const dir = resolveChildDir(entry.path, root);
+  if (!existsSync7(dir)) {
+    return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
+  }
+  if (existsSync7(join7(dir, ".sechroom.json"))) {
+    return {
+      label: entry.path,
+      dir,
+      disposition: "refresh",
+      argv: ["onboard", "--refresh", "--yes"],
+      reason: "bound (committed .sechroom.json) \u2014 refresh in place"
+    };
+  }
+  if (entry.workspaceId) {
+    return {
+      label: entry.path,
+      dir,
+      disposition: "bind",
+      argv: ["onboard", "--yes", "--local", "--workspace", entry.workspaceId],
+      reason: `unbound \u2014 bind to ${entry.workspaceId}`
+    };
+  }
+  if (opts.dryRun) {
+    return { label: entry.path, dir, disposition: "bind", argv: ["onboard", "--yes", "--local", "--workspace", "<prompt>"], reason: "unbound \u2014 would prompt for a workspace" };
+  }
+  if (opts.yes || !canPrompt()) {
+    return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound + no workspace (run interactively, or add it to ./.sechroom/repos.json)" };
+  }
+  process.stderr.write(`
+${style.bold(entry.path)} ${style.dim("is not bound yet.")}
+`);
+  const ws = await pickWorkspace(client, `Bind ${style.cyan(entry.path)} to a workspace:`);
+  if (!ws) {
+    return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound \u2014 no workspace chosen (skipped)" };
+  }
+  return {
+    label: entry.path,
+    dir,
+    disposition: "bind",
+    argv: ["onboard", "--yes", "--local", "--workspace", ws],
+    reason: `unbound \u2014 bind to ${ws}`
+  };
+}
+async function resolveFanoutLane(cfg, opts) {
+  let code = opts.lane ?? process.env.SECHROOM_CODE_LANE;
+  let design = opts.designLane ?? process.env.SECHROOM_DESIGN_LANE;
+  if (!code || !design) {
+    const inferred = await inferLanes(cfg, ["claude-code"]);
+    code = code ?? inferred.code;
+    design = design ?? inferred.design;
+  }
+  if (!opts.lane && !opts.yes && !opts.dryRun && canPrompt() && (code || design)) {
+    process.stderr.write(`
+This fan-out will pin the same lane in every repo:
+`);
+    if (code) process.stderr.write(`  ${style.dim("code-lane")}   = ${style.cyan(code)}
+`);
+    if (design) process.stderr.write(`  ${style.dim("design-lane")} = ${style.cyan(design)}
+`);
+    if (!await promptYesNo("Use this lane for all repos?")) {
+      code = await promptText("Code-lane id (blank = let each repo infer)?", code ?? "") || void 0;
+      design = await promptText("Design-lane id (blank = skip)?", design ?? "") || void 0;
+    }
+  }
+  if (code) process.env.SECHROOM_CODE_LANE = code;
+  else delete process.env.SECHROOM_CODE_LANE;
+  if (design) process.env.SECHROOM_DESIGN_LANE = design;
+  else delete process.env.SECHROOM_DESIGN_LANE;
+  return { code, design };
+}
+async function runRecurse(cfg, g, opts) {
+  const { yes, dryRun, json } = opts;
+  const root = process.cwd();
+  const manifestPath = join7(root, ".sechroom", "repos.json");
+  const fromManifest = readManifest(manifestPath);
+  const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
+  const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
+  if (entries.length === 0) {
+    if (json) process.stdout.write(JSON.stringify({ recurse: true, root, repos: [] }) + "\n");
+    else process.stderr.write(`${warn("\u26A0")} no child repos found ${fromManifest ? `in ${manifestPath}` : `under ${root}`} \u2014 nothing to do.
+`);
+    return;
+  }
+  if (!json) {
+    process.stderr.write(`${style.bold("onboard --recurse")} ${style.dim(`(${entries.length} repo${entries.length === 1 ? "" : "s"} from ${sourceLabel})`)}
+`);
+  }
+  const lane = await resolveFanoutLane(cfg, { lane: opts.lane, designLane: opts.designLane, yes, dryRun });
+  if (!json && lane.code) process.stderr.write(`${ok("\u2713")} lane ${style.cyan(lane.code)}${lane.design ? ` ${style.dim(`/ ${lane.design}`)}` : ""} for every repo
+`);
+  const client = await makeClient(cfg);
+  const plans = [];
+  for (const entry of entries) plans.push(await planRecurseChild(entry, root, client, { yes, dryRun }));
+  const results = runChildren(plans, { globals: passthroughGlobals(g), dryRun, json });
+  if (json) {
+    process.stdout.write(JSON.stringify({ recurse: true, root, dryRun, repos: results }) + "\n");
+    return;
+  }
+  summarizeFanout(results, { dryRun });
+}
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
     "after",
     `
 Examples:
@@ -3201,6 +3414,8 @@ Examples:
   $ sechroom onboard --no-mcp           agent instructions only, skip MCP config
   $ sechroom onboard --local            save tenant + base URL to a committed ./.sechroom.json
   $ sechroom onboard --workspace wsp_XX  bind this directory to a workspace (no pick prompt)
+  $ sechroom onboard --recurse          orchestration root: onboard every child repo under this dir
+  $ sechroom onboard --recurse --lane claude-code-you   pin one lane across every repo in the tree
   $ sechroom onboard --refresh          refresh out-of-date instruction blocks in place
   $ sechroom onboard --check            CI/pre-commit: nonzero exit if instructions are out of date
   $ sechroom onboard --yes              non-interactive: defaults + global config + full wire
@@ -3212,6 +3427,15 @@ Examples:
     const mode = opts.check ? "check" : opts.force ? "force" : "apply";
     const check = mode === "check";
     const yes = Boolean(opts.yes) || check;
+    if (opts.lane) process.env.SECHROOM_CODE_LANE = opts.lane;
+    if (opts.designLane) process.env.SECHROOM_DESIGN_LANE = opts.designLane;
+    if (opts.recurse) {
+      const baseUrl2 = resolveBaseUrl(g);
+      await ensureAuth({ baseUrl: baseUrl2, tenant: "", clientId: readPersisted().clientId }, yes);
+      const cfg2 = await ensureTenant(baseUrl2, g, { yes: true, json, persist: false });
+      await runRecurse(cfg2, g, { yes, dryRun, json, lane: opts.lane, designLane: opts.designLane });
+      return;
+    }
     const baseUrl = resolveBaseUrl(g);
     await ensureAuth({ baseUrl, tenant: "", clientId: readPersisted().clientId }, yes);
     const cfg = await ensureTenant(baseUrl, g, { yes, json, local: Boolean(opts.local), workspace: opts.workspace, persist: !check });
@@ -3365,18 +3589,17 @@ ${style.bold("Next:")} paste this into your AI agent to get going \u2014
 }
 
 // src/commands/sweep.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import { dirname as dirname6, isAbsolute, join as join6, resolve } from "path";
-var DEFAULT_MANIFEST = join6(".sechroom", "repos.json");
+import { existsSync as existsSync8 } from "fs";
+import { dirname as dirname6, join as join8, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join8(".sechroom", "repos.json");
 function planEntry(entry, root) {
-  const dir = isAbsolute(entry.path) ? entry.path : resolve(root, entry.path);
-  if (!existsSync6(dir)) {
-    return { entry, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
+  const dir = resolveChildDir(entry.path, root);
+  if (!existsSync8(dir)) {
+    return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
     return {
-      entry,
+      label: entry.path,
       dir,
       disposition: "refresh",
       argv: ["onboard", "--refresh", "--yes"],
@@ -3385,7 +3608,7 @@ function planEntry(entry, root) {
   }
   if (entry.workspaceId) {
     return {
-      entry,
+      label: entry.path,
       dir,
       disposition: "bind",
       argv: ["onboard", "--yes", "--local", "--workspace", entry.workspaceId],
@@ -3393,29 +3616,21 @@ function planEntry(entry, root) {
     };
   }
   return {
-    entry,
+    label: entry.path,
     dir,
     disposition: "skip-unbound",
     argv: [],
     reason: "unbound + no workspaceId in the manifest \u2014 add one or run `sechroom onboard` there"
   };
 }
-function passthroughGlobals(g) {
-  const out = [];
-  if (g.baseUrl) out.push("--base-url", g.baseUrl);
-  if (g.tenant) out.push("--tenant", g.tenant);
-  return out;
-}
-var ICON = {
-  refresh: "\u21BB",
-  bind: "+",
-  "skip-missing": "\u2013",
-  "skip-unbound": "\u26A0"
-};
 function registerSweep(program2) {
-  program2.command("sweep").description("Orchestration-root fan-out: run `sechroom onboard` in every repo listed in ./.sechroom/repos.json").option("--manifest <path>", "path to the repos manifest", DEFAULT_MANIFEST).option("--dry-run", "print the plan (per-repo disposition + the onboard command) without running anything", false).addHelpText(
+  program2.command("sweep").description("Non-interactive fan-out from ./.sechroom/repos.json (headless sibling of `onboard --recurse`)").option("--manifest <path>", "path to the repos manifest", DEFAULT_MANIFEST).option("--dry-run", "print the plan (per-repo disposition + the onboard command) without running anything", false).addHelpText(
     "after",
     `
+For an interactive, no-manifest run use ${"`sechroom onboard --recurse`"} instead \u2014 it
+auto-discovers the child repos and prompts for a workspace per new one. ${"`sweep`"} is
+the deterministic manifest-driven form for scripts / CI.
+
 Manifest \u2014 ./.sechroom/repos.json (per-operator, gitignored, alongside lane.json):
   {
     "repos": [
@@ -3439,28 +3654,23 @@ Examples:
     const g = cmd.optsWithGlobals();
     const json = Boolean(g.json);
     const dryRun = Boolean(opts.dryRun);
-    const manifestPath = resolve(opts.manifest);
-    if (!existsSync6(manifestPath)) {
-      fail(`no manifest at ${manifestPath} \u2014 create ./.sechroom/repos.json listing the repos under this root (see \`sechroom sweep --help\`).`);
-    }
-    let manifest;
+    const manifestPath = resolve2(opts.manifest);
+    let repos;
     try {
-      manifest = JSON.parse(readFileSync5(manifestPath, "utf8"));
+      repos = readManifest(manifestPath);
     } catch (err2) {
-      fail(`couldn't parse ${manifestPath}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+      fail(err2 instanceof Error ? err2.message : String(err2));
+    }
+    if (repos === null) {
+      fail(`no manifest at ${manifestPath} \u2014 create ./.sechroom/repos.json, or use \`sechroom onboard --recurse\` to auto-discover (see \`sechroom sweep --help\`).`);
     }
-    const repos = Array.isArray(manifest.repos) ? manifest.repos.filter((r) => r && typeof r.path === "string") : [];
     if (repos.length === 0) {
-      if (json) {
-        process.stdout.write(JSON.stringify({ manifest: manifestPath, repos: [] }) + "\n");
-      } else {
-        process.stderr.write(`${warn("\u26A0")} ${manifestPath} lists no repos \u2014 nothing to do.
+      if (json) process.stdout.write(JSON.stringify({ manifest: manifestPath, repos: [] }) + "\n");
+      else process.stderr.write(`${warn("\u26A0")} ${manifestPath} lists no repos \u2014 nothing to do.
 `);
-      }
       return;
     }
     const root = dirname6(dirname6(manifestPath));
-    const globals = passthroughGlobals(g);
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -3468,70 +3678,24 @@ Examples:
 `
       );
     }
-    const results = [];
-    for (const plan of plans) {
-      const runs = plan.argv.length > 0;
-      const argv = runs ? [...globals, ...plan.argv] : [];
-      const skipped2 = !runs;
-      if (!json) {
-        const head = `  ${ICON[plan.disposition]} ${style.cyan(plan.entry.path)} ${style.dim(plan.reason)}`;
-        process.stderr.write(head + "\n");
-        if (runs && dryRun) process.stderr.write(`      ${style.dim(`would run: sechroom ${argv.join(" ")}`)}
-`);
-      }
-      let exitCode = skipped2 ? null : 0;
-      if (runs && !dryRun) {
-        const res = spawnSync(process.execPath, [process.argv[1], ...argv], {
-          cwd: plan.dir,
-          stdio: json ? "ignore" : "inherit"
-        });
-        exitCode = res.status;
-        if (!json) {
-          process.stderr.write(
-            exitCode === 0 ? `      ${ok("\u2713")} ${style.dim("onboard ok")}
-` : `      ${warn("\u2717")} ${style.dim(`onboard exited ${exitCode ?? "signal"}`)}
-`
-          );
-        }
-      }
-      results.push({
-        path: plan.entry.path,
-        dir: plan.dir,
-        disposition: plan.disposition,
-        ran: runs && !dryRun,
-        exitCode,
-        reason: plan.reason
-      });
-    }
+    const results = runChildren(plans, { globals: passthroughGlobals(g), dryRun, json });
     if (json) {
       process.stdout.write(JSON.stringify({ manifest: manifestPath, dryRun, repos: results }) + "\n");
       return;
     }
-    const ran = results.filter((r) => r.ran);
-    const failed = ran.filter((r) => r.exitCode !== 0);
-    const skipped = results.filter((r) => r.disposition.startsWith("skip"));
-    const wouldRun = results.filter((r) => !r.disposition.startsWith("skip"));
-    const tally = (dryRun ? [wouldRun.length ? `${wouldRun.length} would onboard` : null, skipped.length ? `${skipped.length} would skip` : null] : [
-      ran.length ? `${ran.length - failed.length}/${ran.length} onboarded` : null,
-      skipped.length ? `${skipped.length} skipped` : null,
-      failed.length ? `${failed.length} failed` : null
-    ]).filter(Boolean).join(", ");
-    process.stderr.write(`
-${failed.length ? warn("\u26A0") : ok("\u2713")} ${tally || "nothing to do"}${dryRun ? style.dim(" (dry run)") : ""}
-`);
-    if (failed.length) process.exit(1);
+    summarizeFanout(results, { dryRun });
   });
 }
 
 // src/commands/skills.ts
 import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, rmSync as rmSync2, existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { join as join9 } from "path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, rmSync as rmSync2, existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
 var DEFAULT_SLUG = "operator-skills";
 var ROLE_TAGS = ["sechroom:role:skill-template", "role:skill-template"];
 var LOCK = ".sechroom-skills.json";
 function skillsDir(global) {
-  return global ? join7(homedir6(), ".claude", "skills") : join7(process.cwd(), ".claude", "skills");
+  return global ? join9(homedir6(), ".claude", "skills") : join9(process.cwd(), ".claude", "skills");
 }
 function tagValue2(tags, prefix) {
   return (tags ?? []).find((t) => t.startsWith(prefix))?.slice(prefix.length);
@@ -3609,13 +3773,13 @@ Examples:
       const name = tagValue2(tags, "skill:");
       if (!name) continue;
       const body = m.text ?? m.Text ?? "";
-      mkdirSync6(join7(dir, name), { recursive: true });
-      writeFileSync6(join7(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
+      mkdirSync6(join9(dir, name), { recursive: true });
+      writeFileSync6(join9(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
       written.push(name);
     }
     mkdirSync6(dir, { recursive: true });
-    const lockPath = join7(dir, LOCK);
-    const lock = existsSync7(lockPath) ? JSON.parse(readFileSync6(lockPath, "utf8")) : {};
+    const lockPath = join9(dir, LOCK);
+    const lock = existsSync9(lockPath) ? JSON.parse(readFileSync6(lockPath, "utf8")) : {};
     lock[slug] = { surface: opts.surface, version, instance: wantInstance, skills: written.sort() };
     writeFileSync6(lockPath, JSON.stringify(lock, null, 2) + "\n");
     if (opts.json) return emit({ slug, version, instance: wantInstance, surface: opts.surface, dir, installed: written }, true);
@@ -3639,15 +3803,15 @@ Examples:
   skills.command("clean [slug]").description(`Remove materialised skill files written by install (default ${DEFAULT_SLUG})`).option("--local", "clean ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts) => {
     const slug = slugArg || DEFAULT_SLUG;
     const dir = skillsDir(!opts.local);
-    const lockPath = join7(dir, LOCK);
-    if (!existsSync7(lockPath)) fail(`No skills lockfile at ${lockPath}; nothing to clean.`);
+    const lockPath = join9(dir, LOCK);
+    if (!existsSync9(lockPath)) fail(`No skills lockfile at ${lockPath}; nothing to clean.`);
     const lock = JSON.parse(readFileSync6(lockPath, "utf8"));
     const entry = lock[slug];
     if (!entry) fail(`No installed record for '${slug}' in ${lockPath}.`);
     const removed = [];
     for (const name of entry.skills) {
-      const skillPath = join7(dir, name);
-      if (existsSync7(skillPath)) {
+      const skillPath = join9(dir, name);
+      if (existsSync9(skillPath)) {
         rmSync2(skillPath, { recursive: true, force: true });
         removed.push(name);
       }
@@ -3743,21 +3907,21 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir7 } from "os";
-import { join as join8 } from "path";
-import { existsSync as existsSync8, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+import { join as join10 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK = ".sechroom-skills.json";
-var localSkillsDir = () => join8(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join8(homedir7(), ".claude", "skills");
+var localSkillsDir = () => join10(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join10(homedir7(), ".claude", "skills");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join8(dir, SKILLS_LOCK);
-  if (!existsSync8(lockPath)) return removed;
+  const lockPath = join10(dir, SKILLS_LOCK);
+  if (!existsSync10(lockPath)) return removed;
   try {
     const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join8(dir, name);
-        if (existsSync8(p)) {
+        const p = join10(dir, name);
+        if (existsSync10(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -3788,18 +3952,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join8(process.cwd(), ".sechroom");
-    if (existsSync8(stateDir)) {
+    const stateDir = join10(process.cwd(), ".sechroom");
+    if (existsSync10(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join8(process.cwd(), ".sechroom.json");
-    if (existsSync8(legacyCfg)) {
+    const legacyCfg = join10(process.cwd(), ".sechroom.json");
+    if (existsSync10(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join8(process.cwd(), ".sem");
-    if (existsSync8(legacySem)) {
+    const legacySem = join10(process.cwd(), ".sem");
+    if (existsSync10(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.24",
+  "version": "2026.6.26",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",